Tech
The Rise of ‘Second-Hand’ Zero-Days: Inside the Coruna iOS Exploit Kit
A sophisticated iOS exploit kit named “Coruna” is making waves in the cybersecurity world, not just for its technical prowess – boasting 23 exploits across five full chains – but for its unusual journey through multiple threat actor groups. Google’s Threat Intelligence Group (GTIG) has been tracking Coruna’s evolution, revealing a concerning trend: a potential market for previously used, but still potent, zero-day exploits.
From Surveillance to Espionage to Financial Gain
Coruna’s path is particularly alarming. Initially detected in February 2025 in use by a customer of a surveillance vendor, the kit quickly surfaced in the hands of a suspected Russian espionage group targeting Ukrainian users in July 2025. By December 2025, it had fallen into the grasp of a financially motivated threat actor operating from China. This rapid proliferation suggests a disturbing reality: exploits aren’t simply retired after a single campaign.
“How this proliferation occurred is unclear, but suggests an active market for ‘second hand’ zero-day exploits,” Google researchers noted. This raises questions about the security of these exploits after initial use and the potential for them to resurface in unexpected attacks.
Technical Deep Dive: What Makes Coruna Dangerous?
Coruna targets iPhones running iOS 13.0 through 17.2.1, a broad range of devices. The kit leverages a mix of publicly known and previously unknown vulnerabilities, utilizing both CVE-tracked issues and zero-days. Many of the vulnerabilities have since been patched, but the kit’s ability to combine multiple exploits into complete chains makes it a formidable threat.
Here’s a breakdown of some of the key exploits within Coruna:
| Type | Codename | Targeted versions (inclusive) | Fixed versions | CVE |
| WebContent R/W | buffout | 13 → 15.1.1 | 15.2 | CVE-2021-30952 |
| WebContent R/W | jacurutu | 15.2 → 15.5 | 15.6 | CVE-2022-48503 |
| WebContent R/W | bluebird | 15.6 → 16.1.2 | 16.2 | No CVE |
CISA’s Response and Ongoing Risks
The Cybersecurity and Infrastructure Security Agency (CISA) has added three of the CVEs exploited by Coruna to its Known Exploited Vulnerabilities catalog: CVE-2021-30952, CVE-2023-41974, and CVE-2023-43000. CISA urges agencies to apply vendor-provided mitigations or discontinue use of affected products if updates aren’t available. The agency warns that these vulnerabilities are “frequent attack vectors” and pose “significant risks.”
What Does This Mean for the Future?
The Coruna case highlights a worrying trend: the commoditization of exploits. As GTIG discovered, the kit even included a debug version exposing internal code names, suggesting a level of carelessness that facilitated its spread. This raises several concerns:
- Increased Accessibility: A market for used exploits lowers the barrier to entry for less sophisticated attackers.
- Prolonged Risk: Even patched vulnerabilities can become relevant again if exploits are resold and re-used.
- Supply Chain Concerns: The initial use by a surveillance vendor raises questions about the security practices within that industry.
The proliferation of Coruna underscores the need for proactive security measures, including rapid patching, robust vulnerability management programs, and increased information sharing between security researchers and vendors.
Frequently Asked Questions
What is an exploit kit?
An exploit kit is a collection of tools and exploits used to target vulnerabilities in software, allowing attackers to gain unauthorized access to systems.
What is a zero-day exploit?
A zero-day exploit targets a vulnerability that is unknown to the software vendor, meaning there is no patch available when the exploit is first used.
How can I protect myself from exploit kits?
Keep your software up to date, use strong passwords, be cautious about clicking on links or downloading attachments from unknown sources, and consider using a reputable security solution.
What is CISA’s role in responding to vulnerabilities?
CISA identifies and catalogs known exploited vulnerabilities, providing guidance and resources to help organizations mitigate risks.
Is my iPhone safe if I have the latest iOS version?
While updating to the latest iOS version significantly reduces your risk, no system is entirely immune to attack. Staying vigilant and practicing good security hygiene is crucial.
Pro Tip: Enable automatic updates on your iPhone to ensure you receive the latest security patches as soon as they are available.
Want to learn more about mobile security threats? Explore Google’s Security resources.
Share your thoughts on this evolving threat landscape in the comments below!
